missed one more reference to insecure url - fixed to secure